Extracted

• • Target

    a634052144ca4c55b40b8a317b87b96ee607247fabc2be5147b4366f68736343.exe

  • Size

    416KB

  • MD5

    a900e5b935fb234ab80949e8f294fcff

  • SHA1

    d640f06b8b1470fc0d2011805258b9af0b7612f2

  • SHA256

    a634052144ca4c55b40b8a317b87b96ee607247fabc2be5147b4366f68736343

  • SHA512

    8c30347773d7d058fde8f1371914715e902d924941794e20a5a101ff3447192eb63b97eeb7d552f0223c6831f0bc94beb4b140ce9e553eee0a84b40b5630fb2a

  • SSDEEP

    6144:ITNE3ZRrnaBVlvphVxmP+6CiejgcME1cwYfU+va+RU7o:ITNYrnE3bm/CiejewY5vH

  Score

  10^/10

  nanocorediscoveryevasionkeyloggerpersistencespywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Nanocore family

    nanocore

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2